Unscored severity · published Dec 31, 2004
CVE-2004-2115
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1)…
–
CVSS
58.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
Exploitation
Is it being used?
Exploit prediction (EPSS)58.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
Http Server · Oracle
8.1.7; 9.0.1; 9.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2115
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2115
marc.info
http://marc.info/?l=bugtraq&m=107496560106967&w=2
Exploit
http://www.securityfocus.com/bid/9484
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/14930
More from Http Server
10.0
CVE-2026-21962
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2021-4034
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability
10.0
CVE-2026-60365
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers)